Digital forensics, for when you need answers
Something happened. We work out what, how, since when and what it touched, from the evidence your systems left behind. And before anything happens, we help you prepare to respond.
Overview
What forensics can tell you
After an incident, the questions are always the same: how did they get in, what did they reach, is it over, and what do we tell people. Guesses are cheap and usually wrong. Answers come from logs, disks, memory, network traffic and the files the intruder left, examined carefully and in the right order.
Black Fox carries out incident post-mortem analysis, network and storage forensics, reverse engineering of malicious or suspicious code, and data recovery. We preserve evidence so it can still be relied on later, reconstruct the timeline and write it down in a form your management, your insurers or your lawyers can use.
The better half of incident response happens before the incident. We help you write a response plan, decide who does what, and rehearse it in tabletop exercises, so the first time your team runs the plan is not the real thing.
Who it is for
Organisations that have had, or suspect, a security incident and need to know what happened, and organisations that want to be ready before they do, including those whose obligations under NIS2, DORA or the GDPR call for incident handling and reporting.
The work, from scoping to evidence.
What we do
Incident post-mortem analysis
A reconstruction of what happened: initial access, movement, persistence, what was touched or taken, and the gaps that made it possible.
Network forensics
Analysis of traffic captures, firewall, proxy and DNS logs, among others, to trace connections, data transfers and command channels.
Storage forensics
Disk and system images examined for artefacts, deleted files, timelines and traces of tools, with evidence handled so its integrity can be shown.
Reverse engineering
Suspicious binaries, scripts and documents taken apart to understand what they do, how they persist and what they talk to.
Data recovery
Recovery of deleted, damaged or hidden data from the media and backups available, where it can still be recovered.
Response readiness
Incident response plans, roles, contact lists and playbooks, rehearsed with your team in tabletop exercises.
How the engagement runs
First contact
You tell us what you see. We agree the scope, the people involved and how evidence is handled, and sign an NDA first if you need one.
Preservation
We advise on what to keep running, what to isolate and what to collect first, so evidence is not lost while the problem is contained.
Analysis
We examine the evidence, build the timeline and test each hypothesis against the data, reporting interim findings as they firm up.
Recommendations
We tell you what to close, what to rebuild and what to watch, so the same door does not open twice.
Report and closing
A business report for management and a technical report with the evidence, followed by a closing session where we review the engagement with you.
What you receive
- Incident timeline with supporting evidence
- Technical forensic report
- Business report for management, insurers or counsel
- Malware or artefact analysis, where relevant
- Recovered data, where recovery was possible
- Incident response plan and tabletop exercise report, for readiness work
Questions
How quickly can you respond?
We do not promise response times. Contact us as soon as you suspect something, and we will tell you plainly what we can do and when. If you want a defined arrangement, agree a retainer with us in advance, before you need it.
Should we switch everything off?
Not without thinking first. Shutting systems down can destroy evidence held in memory, while leaving them connected can let an intruder continue. Isolate what you can, write down what you do and when, and talk to us before you wipe or rebuild anything.
Do you notify the authorities for us?
Notification decisions belong to you and your legal advisers. We give you the facts they need to decide, for example under the GDPR or NIS2, and help you prepare the technical content of a notification.
Can our evidence be used in court?
We collect and handle evidence so that its integrity can be shown and every step is documented. Whether it is admissible is a matter for your lawyers and the court.
Related services
- Advisory and responseSecurity awareness trainingTraining from Black Fox Security: security and social engineering awareness, incident response and DevSecOps, for staff, developers and management.
- Governance and riskBusiness continuity and disaster recoveryBCP and DRP from Black Fox Security: business impact analysis, continuity and recovery plans, backup and restore testing and tabletop exercises that test the plan.
- Compliance and certificationNIS2NIS2 support from Black Fox Security: applicability check, gap assessment against the risk-management measures, incident reporting, supply chain and training.
- Managed securitySecurity hardeningSecurity hardening by Black Fox Security: endpoint, server and network hardening, secure configuration baselines, monitoring setup and personal security.
When you need answers, ask
Tell us what you are seeing, or what you want to be ready for. We will tell you what we can find out and how.